mwac.sys BSoD

[AdvancedSetup]

I'm sorry perhaps someone else can assist you. I'm apparently just not understanding what you want.

 

[jenine]

27 minutes ago, AdvancedSetup said:

On April 10 you said you used our MBST tool to do a clean removal and reinstall of the program and all was well.

From the following link

https://forums.malwarebytes.com/topic/258349-malwarebytes-410-and-adguard-73-problem/?do=findComment&comment=1372355

 

 

Please do the following Uninstall and reinstall using the Malwarebytes Support Tool

Please have lots of patience with the tool.  The first phase is a cleanup and does require a Windows Restart.
After the Restart, it may take 2 - 3 - 4 minutes till the Support tool screen shows up.   Please be patient and have faith.  Wait for it, whatever it takes.
The 2nd phase is where it offers to do a new Install.

 Let me know if that clears up the issue or not.

 

Stop bringing up the past whats your problem it has nothing to do with MWB not working right since 4 came out PLEASE just answer the question what order should I put them back in????.  If you want to know why I removed it back then since you brought it up 2 times it was to get rid of the BAD beta you had me install and YES your steps worked great to put it BACK.    

[jenine]

  On 4/10/2020 at 7:28 PM, jenine said:

Hi, I just put in your beta 41056/1022260/10875 and now my system takes longer to boot and did not solve the ad problem with Adguard by turning on the WFP filter (some ad's were blocked now with the new beta but some still got through).  I’m done with testing I don’t have time how do I remove this beta and put back the current version ASAP I need my system for work …..Everything was working great before this beta by just turning off the WFP filter in asguard…...I just turned the filter off again and now I dont have ANY ads even with your beta...Thats great but I want to still remove this beta?  Please give me the steps to put back the current version.  Thanks 

Also I don't consider what I wrote being a FIX "Everything was working great before this beta by just turning off the WFP filter in adguard…...I just turned the filter off again and now I dont have ANY ads even with your beta...Thats great but I want to still remove this beta?  Please give me the steps to put back the current version". Again ALL you ever do is have workarounds rather then FIX your program.  I should not have to turn off the WFP filter as many people have said in the past 6 DAYS????  Thanks 

•  
•  
• Quote

[EvilPeppard]

14 hours ago, AdvancedSetup said:

If you do a Clean reinstall of Malwarebytes using our MBST tool. There is no current issue with Adguard that I'm aware of unless a new update from Adquard has changed that.

Uninstall and reinstall Malwarebytes using the Malwarebytes Support Tool

If you have a direct link to a developer from Adguard that wants to spend their time working to make their product compatible with ours, by all means please have them contact us, but as I said, from the last update issues with Adguard were fixed.

 

 

So do you need me to re-enable AdGuard's WFP Network driver and see if I still BSOD with MWB Premium's Web Protection enabled? Because that has been the issue the entire time for me in this thread. I have supplied several sets of log files and provided all info I was requested from you guys to help out with this issue, but unless I missed it, I don't recall seeing something posted in the last 6 days from my last post that compatibility issues were fixed.

Let me know. Thank you.

My post from just last Saturday; 6 days ago: 

 

[AdvancedSetup]

Hello @EvilPeppard

There are multiple posts here and possibly some confusion. From my understanding the issue with AdGuard Premium is/was fixed already. However you still have an unresolved BSOD even with the latest beta version of Malwarebytes (CU8)  at this time.

Your BSOD has not been addressed so further testing from you with AdGuard Premium is probably not possible at this time. For other users though, based on other topics, I was led to believe the AdGuard issue was resolved.

 

[jenine]

Just followed your steps and you are correct MWB and Adguard are now working fine together with the WFP driver on in Adguard.  Thank you for your help.

[GhostOfRaistlin]

So! Do we have an actually solution on this problem instead of the deactivate workaround?

 

[jenine]

Yes Adguard 7.3 with WFP driver on and current MWB 4.1.0 all protection on are working fine together on a windows 10 64 bit system (Up to date) system.  Follow the steps AdvancedSetup has listed by doing a clean reinstall of Malwarebytes using our MBST tool and then uninstall Adguard.

[LiquidTension]

 Hi all,

Thank you for your continued feedback.

For those of you who have yet to do so, please ensure Malwarebytes component package 1.0.889 or higher is installed. If you have AdGuard installed, please ensure version 7.3 or higher is installed.

If you continue to experience an issue with blue screens after checking the above:

• For those with AdGuard, please apply the workaround to disable the Windows Filtering Platform driver in AdGuard and reboot the machine. We are actively working on reliably reproducing this incompatibility.
• For those without AdGuard, please start your own new topic and provide the logs mentioned here.

Edited May 1, 2020 by LiquidTension

[EvilPeppard]

2 hours ago, jenine said:

Yes Adguard 7.3 with WFP driver on and current MWB 4.1.0 all protection on are working fine together on a windows 10 64 bit system (Up to date) system.  Follow the steps AdvancedSetup has listed by doing a clean reinstall of Malwarebytes using our MBST tool and then uninstall Adguard.

Good morning @jenine

Are you 100% sure this is working? How long has your computer been up after enabling both of these? Have you been up for more than a few days running AdGuard 7.3 and MWB Premium 4.1.0.56 with component package 1.0.889?

I am running AdGuard Premium 7.3 and the latest versions of MWB, both production and betas (when available) and I BSOD if I have both MWB Premium Web Protection AND AdGuard WFP Driver enabled. This was happening as recently as a couple weeks ago. AdGuard even confirms this is an issue: https://forum.adguard.com/index.php?threads/malwarebytes-web-protection-blocks-the-adguard-web-assistant.36914/post-197444

I don't want to risk enabling both again unless there is a confirmed fix from MWB and AdGuard that these two can run together. BSODs are no good on our machines, and I don't want to risk corruption or data loss from a BSOD.

Let us know. Thank you for your time and feedback.

[EvilPeppard]

1 hour ago, LiquidTension said:

 Hi all,

Thank you for your continued feedback.

For those of you who have yet to do so, please ensure Malwarebytes component package 1.0.889 or higher is installed. If you have AdGuard installed, please ensure version 7.3 or higher is installed.

If you continue to experience an issue with blue screens after checking the above:

• For those with AdGuard, please apply the workaround to disable the Windows Filtering Platform driver in AdGuard and reboot the machine. We are actively working on reliably reproducing this incompatibility.
• For those without AdGuard, please start your own new topic and provide the logs mentioned here.

@LiquidTension

I just saw your reply after I posted to @Janine.

Thank you for the information. I will continue to run with AdGuard WFP disabled for now until an official fix has been issued.

My system has been running just fine with MWB Premium Web Protection active and AdGuard Premium WFP network driver disabled.

Thanks again.

[boombastik]

@EvilPeppard i bought the adguard for windows for testing and i run it with the latest mbam in wpf mode and i dont see a problem. My nic is intel.

[EvilPeppard]

2 hours ago, boombastik said:

@EvilPeppard i bought the adguard for windows for testing and i run it with the latest mbam in wpf mode and i dont see a problem. My nic is intel.

So you are running MWB Premium (paid version) with Web Protection enabled and AdGuard Premium (paid version) with the WFP Network Driver enabled?

[boombastik]

Yes!

[EvilPeppard]

22 hours ago, boombastik said:

Yes!

Thanks. I am apprehensive to re-enabled AdGuard Premium's WFP and risk another BSOD till I get official word from MWB support to test a new build with ADGuard Premium.

[LiquidTension]

Hi @EvilPeppard,

We've been able to reproduce a BSOD when Malwarebytes is running with AdGuard's WFP driver under heavy network stress. We're currently investigating further. Unfortunately, we can't guarantee anything at this current time.

[EvilPeppard]

46 minutes ago, LiquidTension said:

Hi @EvilPeppard,

We've been able to reproduce a BSOD when Malwarebytes is running with AdGuard's WFP driver under heavy network stress. We're currently investigating further. Unfortunately, we can't guarantee anything at this current time.

@LiquidTension Thank you for the update and confirmation.

I will keep standing by and willing to help test as needed. Just ping me so I am aware.

Thank you.

[TheGift73]

Hi,

I haven't had the BSoD since I first started this thread, however, after updating to Malwarebytes version 4.1.0.56 (Update Packet version 1.0.23942) it has since Green Screened twice within the space of 10 mins.

I am running on the Fast Track Windows Insiders build of Windows 10 Build 19628.1 (Version 2004)

I have attached the required log files.

Would you also like the minidump file as well to check?

Both minidumps point to mwac.sys as the culprit.

I also noticed in this version, that prior to rebooting the machine after it automatically updated Malwarebytes, the pop-up to Reboot or Close the pop-up, kept on showing after hitting Close. This happened approx 10 times before it went away.

After rebooting, when I had another Windows update, the BSoDs happened.

Regards,

Richard

mbst-grab-results.zip

[TheGift73]

Hi,

 

Just noticed that on Page 1 after initially reporting this, you also requested the minidump as well.

I am attaching both for you.

Regards,

Richard

051620-17937-01.dmp 051620-19062-01.dmp

[TheGift73]

Also, I don't use AdGuard, not have I ever, if that helps.

 

[Porthos]

 

1 hour ago, TheGift73 said:

I haven't had the BSoD since I first started this thread, however, after updating to Malwarebytes version 4.1.0.56 (Update Packet version 1.0.23942) it has since Green Screened twice within the space of 10 mins.

You auto upgraded to Controllers Version:     1.0.920 

Which seems to the current beta (Beta Application Updates:   ON)

I would suggest the following. Thank you for the logs you have already provided...

More than likely this will not change or correct the issue, but it will ensure that your installation is good and no corrupt or any old files that did not get updated.

Please try the following STEPS

STEP 1
Please do the following Uninstall and reinstall Malwarebytes using the Malwarebytes Support Tool

Please have lots of patience with the tool.  The first phase is a cleanup and does require a Windows Restart.
After the Restart, it may take 2 - 3 - 4 minutes till the Support tool screen shows up.   Please be patient and have faith.  Wait for it, whatever it takes.
The 2nd phase is where it offers to do a new Install.

 Let us know if that clears up the issue or not.

 

If STEP 1 did not help then please restart the computer and  proceed to STEP 2 so that we can get logs to help us determine the cause

STEP 2
When the issue occurs, do you have a VPN or any other network filtering software enabled (besides Malwarebytes)?
Does this issue consistently present itself when Web Protection is enabled?
Does the issue occur when you are not using Bittorent, qBittorrent, or any other P2P torrent software?

We're in need of additional information to help narrow down the cause of this issue.
Part of this process will involve manually triggering a crash to obtain a memory dump, which will hopefully show what the Web Protection driver is doing to cause this issue. You can read more about this process here.

• Enable debug logging in Malwarebytes (Settings -> General -> Event log data).
• Quit Malwarebytes using the notification area icon. (right-click Quit-Malwarebytes)
• If Smart Screen attempts to block the next step please tell it to allow it.
• Download and double-click the following .reg file: https://malwarebytes.box.com/s/21gdrmaj74xbeiazf6km7tfube246eid
• Download and double-click the following .reg file: https://malwarebytes.box.com/s/c323ski2qkrdvwds615z00j3hg75fn0y
• Restart the computer.
• Launch Malwarebytes and ensure Web Protection is enabled.
• Reproduce the issue.

Once you've reproduced the issue and are actively experiencing it, force a crash by pressing the following keys at the same time: Left Ctrl+Left Alt+U+U.

After the machine has rebooted, you should find a memory dump named MEMORY.dmp in C:\Windows. Please zip this up and provide it to us.

Please follow the directions from the following topic:  Upload Malwarebytes Support Tool logs offline and upload that new log as well on your next reply
 

Thank you

Edited May 16, 2020 by Porthos

[TheGift73]

Hi Porthos,

Have been waiting for the GSoD to appear again, and it triggered just now.

Please find attached the required logs via the Malwarebytes Support Tool as well as the latest dump file.

Q1. When the issue occurs, do you have a VPN or any other network filtering software enabled (besides Malwarebytes)?
Q2. Does this issue consistently present itself when Web Protection is enabled?
Q3. Does the issue occur when you are not using Bittorent, qBittorrent, or any other P2P torrent software?

A1. Yes, I run CactusVPN using IKEv2 encryption. Have been using CactusVPN for a little over 8 years now without any issues
A2. Web protection is always enabled for Malwarebytes
A3. This has only happened when I am connected to a server with CactusVPN (example Romania or Netherlands) and downloading using qBittorrent v4.2.3

Let me know if you need any further information.

053020-18703-01.dmp mbst-grab-results.zip

[Porthos]

On 5/30/2020 at 8:40 AM, TheGift73 said:

Let me know if you need any further information.

I will advise @LiquidTension of your logs.

[Silver_fang]

 

Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\WINDOWS\system32\drivers\mwac.sys
product: Malwarebytes Web Protection
company: Malwarebytes

VPN + torrent application seems to be a common factor to these BSOD's caused by mwac.sys.

Am i right? And if so, why? 

[Porthos]

8 minutes ago, Silver_fang said:

VPN + torrent application seems to be a common factor to these BSOD's caused by mwac.sys.

Am i right? And if so, why? 

I suggest the new BETA.